Executive brief
Zephyr, an operating system for resource-constrained devices, contains a flaw where network connections intended to be secured with the modern TLS 1.3 protocol may silently downgrade to the older TLS 1.2 protocol. This occurs even when developers specifically request TLS 1.3, potentially exposing sensitive communications to known weaknesses associated with older encryption standards. While not a direct breach, it undermines the security expectations of applications relying on the latest encryption for data protection.
Technical details
A protocol downgrade vulnerability exists in Zephyr's socket implementation where the `IPPROTO_TLS_1_3` flag is not properly propagated to the underlying mbedTLS configuration. When both TLS 1.2 and 1.3 are enabled in Kconfig, the ClientHello message advertises both versions, allowing a peer to negotiate a TLS 1.2 connection despite the socket being initialized for TLS 1.3. This occurs because the socket-level protocol selection does not trigger `mbedtls_ssl_conf_min_tls_version`. Attackers or misconfigured peers can force the use of TLS 1.2, bypassing the security benefits of TLS 1.3. A workaround involves manually restricting the `TLS_CIPHERSUITE_LIST` socket option to TLS 1.3-only suites.
Affected products
- Zephyr Project Zephyr <= 4.3.0
Timeline
- 2026-04-15: other: Embargo date
- 2026-05-11: advisory
- 2026-05-11: disclosed